I 



CO 
I 











oo 




200 

IDENTIFY AN INCOMING TRANSMISSION INCLUDING AT 
LEAST ONE IDENTIFIABLE PORTION 



201 

COMPUTE, FOR EACH IDENTIFIABLE PORTION IN THE 
INCOMING TRANSMISSION, A FINGERPRINT INDICATIVE 
OF THE IDENTIFIED PORTION, THE FINGERPRINT BEING 
SUBSTANTIALLY UNIQUE TO THE IDENTIFIED PORTION 



I 

202 

STORE THE COMPUTED FINGERPRINT TO GENERATE A 

SET OF STORED FINGERPRINTS 



203 

RECEIVE A SET OF COMPARISON FINGERPRINTS 
CORRESPONDING TO KNOWN PORTIONS, THE 
COMPARISON FINGERPRINTS BEING PREDETERMINED 



204 

COMPARE THE STORED FINGERPRINTS TO THE COMPARISON 
FINGERPRINTS TO IDENTIFY STORED FINGERPRINTS MATCHING 

COMPARISON FINGERPRINTS 




•NO- 



206 

IDENTIFY THE INCOMING TRANSMISSION 
CORRESPONDING TO THE MATCHING 
STORED FINGERPRINT 
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300 

IDENTIFY AN INCOMING TRANSMISSION INCLUDING AT LEAST ONE 

IDENTIFIABLE PORTION 



301 

INCOMING TRANSMISSION FURTHER INCLUDES A SERIES OF 
POTENTIALLY HARMFUL NETWORK TRANSMISSIONS, EACH OF 
THE INCOMING TRANSMISSION OPERABLE TO INCLUDE 

MALICIOUS CODE, WHEREIN THE SUBSEQUENT DISPOSITION 
INCLUDES DELIVERY TO AT LEAST ONE SUCCESSIVE RECIPIENT 



4 

302 

DEMARCATE THE INCOMING TRANSMISSION INTO 
SEGMENTS, EACH SEGMENT OPERABLE TO YIELD A 

FINGERPRINT 



303 

IDENTIFY A SEGMENT TYPE OF EACH SEGMENT, THE 
SEGMENT TYPE CORRESPONDING TO THE CONTENT 

INCLUDED IN THE SEGMENT 



304 

CATEGORIZE EACH OF THE SEGMENTS ACCORDING TO 
A HEURISTIC, THE HEURISTIC INDICATIVE OF A 
LIKELIHOOD OF THE CATEGORIZED SEGMENT 
INCLUDING AN UNDESIRABLE TRANSMISSION 



305 

IDENTIFY A RISK ASSESSMENT OF EACH OF 

THE SEGMENT TYPES 



306 

COMPUTE, FOR EACH IDENTIFIABLE PORTION IN THE 
INCOMING TRANSMISSION, A FINGERPRINT INDICATIVE OF 
THE IDENTIFIED PORTION, THE FINGERPRINT BEING 
SUBSTANTIALLY UNIQUE TO THE IDENTIFIED PORTION 



307 

COMPUTE THE FINGERPRINT VALUE INCLUDING 
DETERMINING A SIGNATURE AND COMPARING 
COMPRISES SIGNATURE MATCHING 



Fig. 4 



308 

STORE THE COMPUTED FINGERPRINT TO GENERATE A SET OF STORED 

FINGERPRINTS 



309 

STORE THE SEGMENT ACCORDING TO THE IDENTIFIED RISK 
ASSESSMENT, STORING FURTHER INCLUDING IDENTIFYING A 

DURATION 

I 

310 

STORE THE CONTENT OF THE SEGMENT WITH THE 
CORRESPONDING FINGERPRINT 



I 

311 

SELECTIVELY STORE, IF THE INCOMING TRANSMISSION DOES 
NOT CORRESPOND TO THE COMPARISON FINGERPRINTS, AT 
LEAST ONE FINGERPRINT CORRESPONDING TO THE 
IDENTIFIABLE PORTIONS OF THE INCOMING TRANSMISSION 



312 

STORE AN INDICATION OF THE SUBSEQUENT DISPOSITION OF 

THE INCOMING TRANSMISSION 




313 

SUBSEQUENT DISPOSITION INCLUDES TRANSMITTING 
THE INCOMING TRANSMISSION TO A LIST OF 
SUCCESSIVE RECIPIENTS 















I 

314 

RECEIVE A SET OF COMPARISON FINGERPRINTS 
CORRESPONDING TO KNOWN PORTIONS, THE COMPARISON 
FINGERPRINTS BEING PREDETERMINED 



315 

COMPARISON FINGERPRINTS ARE VIRUS SIGNATURES 
COMPUTED FROM KNOWN UNDESIRABLE 

TRANSACTIONS 



316 

COMPARE THE STORED FINGERPRINTS TO THE COMPARISON 
FINGERPRINTS TO IDENTIFY STORED FINGERPRINTS MATCHING 

COMPARISON FINGERPRINTS 



317 

DETERMINING A SIGNATURE AND COMPARING 
COMPRISES SIGNATURE MATCHING 



31 8 

MATCH FOUND WITH 
SUBSEQUENT SET TO THE 
ITORED FINGERPRINT! 



323 
MESSAGE 

PORTION 

DEEMED 

BENIGN 



YES 
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319 

DETERMINE, BASED ON THE MATCHING OF THE 
SUBSEQUENT SET, IF THE SUBSEQUENT SET OF 
COMPARISON FINGERPRINT IS INDICATIVE OF AN 
UNDESIRABLE PORTION IN THE INCOMING TRANSMISSION 



I 



320 

SELECTIVELY PERFORM, BASED ON THE DETERMINING, A REMEDIAL 
ACTION IN RESPONSE TO THE SUBSEQUENT DISPOSITION 



321 

REMEDIAL ACTION IS SENDING A NOTIFICATION 
TO THE SUCCESSIVE RECIPIENTS INDICATIVE OF 
THE MATCHING INCOMING TRANSMISSION 



322 

RECEIVE A SUBSEQUENT SET OF COMPARISON 
FINGERPRINTS, THE SUBSEQUENT SET INDICATIVE OF 
REFINEMENTS TO THE KNOWN PORTIONS 



Fig. 6 



